The dash character is being used as a token separator in the standard tokenizer for analyzed fields.
See https://www.elastic.co/guide/en/elasticsearch/reference/5.6/analysis-standard-tokenizer.html for details.
There are some fields (“message”, “full_message”, and “source”) which are analyzed by default in Graylog.
If you don’t want Elasticsearch to analyze these fields or want to use a different tokenizer or analyzer configuration, you’ll have to create a custom index template:
http://docs.graylog.org/en/2.4/pages/configuration/elasticsearch.html#custom-index-mappings
You can also check out the tokenization of the “message” field of your messages in Graylog by clicking on one of the messages on the search page, then click on the dropdown menu of the “message” field (next to the magnifying glass) and select “Show terms of message”.